chore: add github workflows

Author: moshloop

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # Enable version updates for Go modules
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/release.yml

@@ -0,0 +1,69 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install svu
+        run: |
+          curl -sL https://github.com/caarlos0/svu/releases/download/v2.3.0/svu_2.3.0_linux_amd64.tar.gz | tar xvz
+          sudo mv svu /usr/local/bin/
+
+      - name: Get current version
+        id: current
+        run: |
+          CURRENT=$(svu current 2>/dev/null || echo "v0.0.0")
+          echo "version=$CURRENT" >> $GITHUB_OUTPUT
+
+      - name: Calculate next patch version
+        id: next
+        run: |
+          NEXT=$(svu patch)
+          echo "version=$NEXT" >> $GITHUB_OUTPUT
+
+      - name: Check if version changed
+        id: check
+        run: |
+          if [ "${{ steps.current.outputs.version }}" == "${{ steps.next.outputs.version }}" ]; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "No new commits since last release"
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "New version: ${{ steps.next.outputs.version }}"
+          fi
+
+      - name: Create and push tag
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag ${{ steps.next.outputs.version }}
+          git push origin ${{ steps.next.outputs.version }}
+
+      - name: Create GitHub Release
+        if: steps.check.outputs.changed == 'true'
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ steps.next.outputs.version }}
+          release_name: ${{ steps.next.outputs.version }}
+          draft: false
+          prerelease: false
+          body: |
+            Automated patch release ${{ steps.next.outputs.version }}
+
+            See [CHANGELOG](https://github.com/${{ github.repository }}/compare/${{ steps.current.outputs.version }}...${{ steps.next.outputs.version }}) for details.

.github/workflows/scorecard.yml

@@ -0,0 +1,57 @@
+name: OSSF Scorecard
+
+on:
+  # Only run on push to main branch
+  push:
+    branches:
+      - main
+  # Run weekly on Saturdays
+  schedule:
+    - cron: '30 1 * * 6'
+  # Allow manual workflow dispatch
+  workflow_dispatch:
+
+# Declare default permissions as read only
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard
+      security-events: write
+      # Needed to publish results
+      id-token: write
+      # Needed to checkout the repository
+      contents: read
+      # Needed for API requests
+      actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Publish results to enable scorecard badges
+          publish_results: true
+
+      # Upload the results as artifacts (optional)
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif